Meet The Malware That Took Down Target

The inimitable Brian Krebs has found some interesting details about the massive Target credit card breach that exposed millions of pieces of customer data over the holidays. The hackers used a specific form of malware dedicated to grabbing sensitive data out of hardened point of sale terminals.

Shortly after news of the Target attack hit the net, someone posted a listing for a virus called POSWDS or Reedum on ThreatExpert.com. Shortly thereafter the listing was pulled but not before it was analyzed. Krebs and his sources found that the version of the software that appeared on Target computers had been specially designed to hide itself from anti-virus software and was “customized to avoid detection and for use in specific environments.”

According to Krebs, the software has been traced to a programmer called Antikiller who put it up for sale on hacker forums. The person or group responsible for selling the cards after the breach also infected Target’s computers, initially accessing the system via a compromised web server and then “hoovering up” the data as it came in.

“Further analysis of the attack has revealed the following: On December 2, the malware began transmitting payloads of stolen data to a FTP server of what appears to be a hijacked website. These transmissions occurred several times a day over a 2 week period. Also on December 2, the cyber criminals behind the attack used a virtual private server (VPS) located in Russia to download the stolen data from the FTP. They continued to download the data over 2 weeks for a total of 11 GBs of stolen sensitive customer information. While none of this data remains on the FTP server today, analysis of publicly available access logs indicates that Target was the only retailer affected. So far there is no indication of any relationship to the Neiman Marcus attack.”

Do yourself a favor and read the Krebs pieces. They are amazingly detailed and the story is chilling and fascinating and it’s great look at just how vulnerable even the most powerful commercial organizations are against a meticulous enemy.

View the Original article

Hackers get encrypted PINs in Target data breach

Holiday shoppers have already been reeling from a breach of Target's database, and their situation isn't improving now that Christmas is over. The store chain has confirmed that the perpetrators took encrypted PIN codes, theoretically scoring access to legions of accounts. There is some consolation for affected customers, though. Target notes that the encryption key rests with an outside payment processor; unless the hackers attacked both companies, they won't have an easy time cracking into the financial data. The reassurances won't help those who've had to replace bank cards in light of the breach, but they do suggest that Target avoided the worst possible outcome.

0 Comments Share

Source: Target

The Columbus Dispatch Tags: breach, e-commerce, ecommerce, hack, internet, pin, retail, security, shopping, target Next: Daily Roundup: Snapchat security exploit, judge okays NSA spying and more! .fyre .fyre-comment-divider

View the Original article

The “Target Breach Flood” Is Already Appearing On The Carder Black Market; Target Reacts

In a deliciously detailed post, security writer Brian Krebs has explained the path taken by credit card numbers stolen in the Target breach on their way to the carder black market. Krebs has far more information in his post but he’s discovered that some card shops have created Target-only sections for the trove of numbers.

Krebs described visiting a particularly infamous card shop where he and an anonymous bank representative found sets of cards belonging to a “base” called Tortuga. In carder slang, a base is simply a source of cards. And Tortuga cards, according to Krebs, belonged to a set of numbers stolen from target stores. Amazingly, many of the cards included zip code or state data, thereby circumventing the fraud protections, as many banks automatically treat out-of-state card purchases as suspect.

How quickly did customer react on hearing about the breach? Clearly not fast enough:

The New England bank decided to purchase 20 of its own cards from this shop, cards from Tortuga bases 6-9, and Tortuga 14 and 15. The store’s “shopping cart” offers the ability to check the validity of each purchased card. Any cards that are checked and found to be invalid automatically get refunded. A check of the cards revealed that just one of the 20 had already been canceled.

Should you be worried? If you shopped in a physical Target store and swiped your credit or debit card there between November 27 and December 15, then the answer is “Yes.” However, thieves cannot fully recreate your card and, say, withdraw cash from your account or make an online purchase. Target media representative Molly Snyder wrote:

1. At this time, there is no indication that there has been any impact to PIN numbers. What this means is their bank PIN debit card or Target debit card still has this additional layer of protection. It also means that someone cannot visit an ATM with a fraudulent card and withdraw cash.
2. We have no indication that the data that was inappropriately accessed included a guest’s date of birth or social security number.
3. The CVV data that may have been impacted was data in the magnetic strip and NOT the three or four-digit code visible on the card that guests use that would allow someone to make an online purchase.

Target CEO Gregg Steinhafel said that customers can enjoy a brief discount on everything at the store as well as free credit monitoring for a year.

We take this crime seriously. It was a crime against Target, our team members, and most importantly, our guests. We’re in this together, and in that spirit, we are extending a 10% discount – the same amount our team members receive – to guests who shop in U.S. stores on Dec. 21 and 22. Again, we recognize this issue has been confusing and disruptive during an already busy holiday season. We want to emphasize that the issue has been addressed and let guests know they can shop with confidence at their local Target stores.”

The small bank Krebs assisted in the exploration of the carder site will probably re-issue all 5,300 of its customer’s cards after Christmas. That just leaves thirty-nine million nine hundred ninety-four thousand seven hundred more cards to check for fraud.

View the Original article